Microsoft Certified: Azure AI Engineer AssociatePlan and manage an Azure AI solutionHard

A telecommunications company is developing an Azure AI solution to analyze call center recordings for quality assurance and agent performance. The solution uses Azure Speech-to-Text and custom Azure Machine Learning models. To comply with data governance policies, all data (including audio recordings and generated transcripts) must be encrypted at rest using customer-managed keys (CMK) stored in a secure hardware security module (HSM). Which Azure Key Vault feature should be used to meet this requirement?

  1. AManaged HSM
  2. BAzure AD-integrated Key Vault
  3. CSoft-delete enabled Key Vault
  4. DStandard Key Vault
Show answer & explanation

Correct answer: A. Managed HSM

Azure Key Vault Managed HSM provides a fully managed, highly available, single-tenant, standards-compliant hardware security module (HSM) service, specifically designed for protecting cryptographic keys using FIPS 140-2 Level 3 validated HSMs, which is a common requirement for CMK with strict compliance needs.

Why the other options are wrong

  • B. Azure AD-integrated Key Vault refers to its authentication method and doesn't specify the underlying key protection level.
  • C. Soft-delete enabled Key Vault is a data protection feature to prevent accidental key deletion, not a feature for the level of hardware security.
  • D. Standard Key Vault stores keys in software or FIPS 140-2 Level 2 validated HSMs, which might not meet the FIPS 140-2 Level 3 requirement for strict compliance.

Azure Key Vault Managed HSM

A fully managed, highly available, single-tenant, standards-compliant cloud service that safeguards cryptographic keys for your cloud applications using FIPS 140-2 Level 3 validated hardware security modules (HSMs).

  • Provides FIPS 140-2 Level 3 validated hardware protection.
  • Single-tenant HSMs for isolation.
  • Ideal for strict regulatory compliance requiring hardware-backed keys.

Memory trick: Managed HSM is like a 'fort Knox' for your encryption keys.

More Plan and manage an Azure AI solution questions